CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

CVE-2026-89590 accel/rocket: Fix error path handling in rocket_job_run()

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89521 sched/core: Handle pick_task() releasing the rq lock

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

the-sanitizer-is-the-weapon-cve-2026-68749-cve-2026-68750-quadratic-dos-in-elixir-html-sanitize-ex

CVE-2026-68749 / CVE-2026-68750 — PoC Quadratic denial of service in htmlsanitizeex 1.5.3. The library exists to neutralise untrusted HTML, but two independent super-linear code paths let a single crafted request pin a BEAM scheduler for seconds. A handful of concurrent requests saturate the...

FullPowers

FullPowers FullPowers is a Proof-of-Concept tool I made for automatically recovering the default privilege set of a service account including SeAssignPrimaryToken and SeImpersonate. Rationale On Windows, some services executed as LOCAL SERVICE or NETWORK SERVICE are configured to run with a...

exploits

exploits Published PoCs can be found at exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

AZL-100923 CVE-2026-87876 affecting package cups 2.4.19-1

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

DEBIAN-CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876

This CUPS vulnerability (a follow-up to CVE-2026-27447 ) involves two case-insensitive comparisons on request-derived usernames in scheduler side paths outside the main authorization path—specifically in printer ACL validation and private-attribute filtering . The mismatched case handling could a...

CVE-2026-87876 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

EUVD-2026-75089

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-87876

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations. Mitigation Fixed on upstream master branch...

CVE-2026-25939-SCADA-FUXA-Unauthenticated-Remote-Arbitrary

👤 Author Mohammed Idrees Banyamer Security Researcher 📌 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2026-25939 , a critical authorization bypass vulnerability in FUXA open-source SCADA/ICS software. The vulnerability allows unauthenticated remote attackers to create,...

CVE-2025-56799

CVE-2025-56799 OS Command Injection Vulnerability via Cache Clearing Scheduler in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2026-72945

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

CVE-2026-72945

CVE-2026-72945 is an information disclosure vulnerability in Windows Task Scheduler , caused by the use of an uninitialized resource . An authorized local attacker with low privileges can exploit this to disclose information, with high confidentiality impact and no integrity or availability impac...

EUVD-2026-73113

Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally...

kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle

A flaw was found in the Linux kernel's networking scheduler. A race condition, which is a problem that occurs when multiple operations try to access the same resource at the same time, exists when network filter operations are run concurrently. This can lead to a Use-After-Free UAF vulnerability,...